topic Re: FirePOWER 6.4 Inline Set Modification in Network Security

FirePOWER 6.4 Inline Set Modification

reheindel — Thu, 02 Apr 2020 22:34:19 GMT

Due to a bug (CSCvq71351) in 6.4.0.7 - inline sets must be deleted/recreated if they need to be edited

Is there any potential traffic impact in deleting/recreating an inline set - as long as you don't push policy until after the inline set is rebuilt?

Seems to me you should not be affecting what the sensor knows about the configuration until the policy is pushed.

It was recommended by TAC to make changes off hours/maintenance window - was this just CYA?

Thanks,

Re: FirePOWER 6.4 Inline Set Modification

Cristian Matei — Sat, 04 Apr 2020 16:13:55 GMT

Hi,

Never tried it, but your logic is correct. TAC recommends pretty much any changes to be done in a maintenance, in my experience, cause you never know in reality. If everything would behave the way it should, there would be no more bugs; you get the point.

Regards,

Cristian Matei.

Re: FirePOWER 6.4 Inline Set Modification

Sheraz.Salim — Sat, 04 Apr 2020 19:27:46 GMT

similar bug hit us in our testing production environment we on version 6.5. TAC suggest the same advise. however we was in testing. in your case better raise a change control. this change is not production impact if you follow the TAC instruction but jsut in case to be safe.

Re: FirePOWER 6.4 Inline Set Modification

reheindel — Mon, 06 Apr 2020 14:52:03 GMT

Thanks Christian, I appreciate the reply and wholeheartedly agree - they are called bugs for a reason.

I have 12 inline sets to recreate - just to be safe I guess I'll just break them down into smaller change windows and do a few at a time - rather than edit/delete/recreate them all at once and push the updated policy a single time.

Bob

Re: FirePOWER 6.4 Inline Set Modification

reheindel — Mon, 06 Apr 2020 14:55:05 GMT

Thank you Sheraz for the reply, we do submit change requests but best to do the entire change in a weekend change window.

I was hoping to edit the configuration on all 12 inline sets (across 4 sensors) at one - and push the policy a single time - but I'll be safe and break the changes into multiple smaller change windows

Bob

Re: FirePOWER 6.4 Inline Set Modification

Cristian Matei — Mon, 06 Apr 2020 15:24:09 GMT

Hi,

You can still do all within the same maintenance window; just do one at a time, verify functionality, move to next one.

Regards,

Cristian Matei.